{"action":"Upgrade gix-path to 0.10.9 or later.","affected":[{"fixed":"0.10.9","introduced":"0.10.8"}],"component":"gix-path","cve_ids":["CVE-2024-40644"],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.10.9"],"ghsa_id":"GHSA-mgvv-9p9g-3jv4","id":"tcs_01M5KF98F9EXVB78KVSAHTBQPT","modified_at":"2026-10-12T18:00:12.400481123Z","published_at":"2024-07-18T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2024-0355","https://crates.io/crates/gix-path","https://rustsec.org/advisories/RUSTSEC-2024-0355.html","https://github.com/GitoxideLabs/gitoxide/commit/15235bf7968042da0493d431bbc955d6f9f54188","https://github.com/advisories/GHSA-mgvv-9p9g-3jv4"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"RUSTSEC-2024-0355","url":"https://osv.dev/vulnerability/RUSTSEC-2024-0355"}],"summary":"gix-path can use a fake program files location"}